ARA-C01 Question 31
Single answerPrivilege inheritanceA Snowflake architect is redesigning role-based access for a finance domain. The custom role hierarchy is as follows: FINANCE_ANALYST is granted to FINANCE_LEAD, and FINANCE_LEAD is granted to FINANCE_ADMIN. The FINANCE_ANALYST role has USAGE on database FIN_DB and schema REPORTING, plus SELECT on all existing tables in REPORTING. The architect wants users with the FINANCE_ADMIN role to automatically inherit the FINANCE_ANALYST privileges through the role hierarchy, without granting object privileges directly to FINANCE_ADMIN. Which statement correctly describes how privilege inheritance works in this scenario?
- A
FINANCE_ADMIN will inherit the privileges granted to FINANCE_ANALYST because privileges granted to a role are available to roles higher in the granted role hierarchy.
- B
FINANCE_ADMIN will inherit only the USAGE privileges from FINANCE_ANALYST, but not the SELECT privileges on tables, because object privileges do not inherit through roles.
- C
FINANCE_ADMIN will not inherit any privileges from FINANCE_ANALYST unless FINANCE_ANALYST is set as the user's active role in the session.
- D
FINANCE_ADMIN will inherit the privileges only if FINANCE_ANALYST was granted with the WITH GRANT OPTION clause.
Show answer and explanation
Correct answer: A
Explanation
Snowflake uses role-based access control in which privileges are granted to roles, and roles can be granted to other roles. This creates a hierarchy where higher roles inherit privileges from lower roles that have been granted to them. In this scenario, FINANCE_ADMIN inherits the FINANCE_ANALYST privileges through FINANCE_LEAD. This is a core design principle for scalable access models: grant object privileges to functional roles and aggregate them into higher-level roles instead of duplicating grants. Also note that inherited access still depends on required supporting privileges, such as USAGE on the database and schema containing the object. This aligns with Snowflake documentation on role hierarchies, access control, and privilege inheritance best practices.
- A. Correct.
Correct. In Snowflake, privileges granted to a role are inherited by any role to which that role is granted, directly or indirectly. Since FINANCE_ANALYST is granted to FINANCE_LEAD and FINANCE_LEAD is granted to FINANCE_ADMIN, FINANCE_ADMIN inherits the privileges held by FINANCE_ANALYST. This includes database, schema, and table privileges, provided the required parent USAGE privileges are also present.
- B. Incorrect.
Incorrect. Object privileges such as SELECT do inherit through the role hierarchy. A common misconception is that only container-level privileges such as USAGE inherit, but Snowflake role inheritance applies to privileges granted to the child role generally, including object privileges like SELECT.
- C. Incorrect.
Incorrect. A user does not need to activate the lowest-level role specifically to benefit from inherited privileges. If the user's active role is FINANCE_ADMIN, the privileges of roles granted to FINANCE_ADMIN are available through the hierarchy. The misconception here is confusing active role selection with direct role assignment; the active role can use inherited privileges from subordinate granted roles.
- D. Incorrect.
Incorrect. WITH GRANT OPTION allows the grantee to grant the privilege onward to other roles, but it is not required for normal privilege inheritance through role grants. Role hierarchy inheritance and grant delegation are separate concepts in Snowflake.